openapi: 3.2.0
info:
  title: Sumo Logic Event Analytics API
  description: '# Getting Started

    Welcome to the Sumo Logic API reference.'
  version: 1.0.0
  x-logo:
    url: ./sumologic_logo.png
servers:
- url: https://api.au.sumologic.com/api/
  description: AU deployment API server
- url: https://api.ca.sumologic.com/api/
  description: CA deployment API server
- url: https://api.de.sumologic.com/api/
  description: DE deployment API server
- url: https://api.eu.sumologic.com/api/
  description: EU deployment API server
- url: https://api.fed.sumologic.com/api/
  description: FED deployment API server
- url: https://api.jp.sumologic.com/api/
  description: JP deployment API server
- url: https://api.kr.sumologic.com/api/
  description: KR deployment API server
- url: https://api.in.sumologic.com/api/
  description: IN deployment API server
- url: https://api.sumologic.com/api/
  description: US1 deployment API server
- url: https://api.us2.sumologic.com/api/
  description: US2 deployment API server
security:
- basicAuth: []
tags:
- name: event analytics
  description: 'Event Analytics (Beta) API.


    APIs for interacting with events in Sumo Logic.'
  x-displayName: Event Analytics (Beta)
paths:
  /v1/eventExtractionRules:
    get:
      tags:
      - event analytics
      summary: Get All Event Extraction Rules
      description: Get all event extraction rules.
      operationId: getEventExtractionRules
      responses:
        default:
          description: Operation failed with an error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '200':
          description: Event extraction rules.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListEventExtractionRulesResponse'
    post:
      tags:
      - event analytics
      summary: Create Event Extraction Rule
      description: Create event extraction rule.
      operationId: createEventExtractionRule
      requestBody:
        description: Information to create a new event extraction rule.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EventExtractionRule'
        required: true
      responses:
        default:
          description: Operation failed with an error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '200':
          description: The event extraction rule was created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventExtractionRuleWithDetails'
  /v1/eventExtractionRules/quota:
    get:
      tags:
      - event analytics
      summary: Get Event Extraction Rules Quota
      description: Every customer can use a limited number of Event Extraction Rules. This endpoint allows learning about these limitations and remaining quota.
      operationId: getEventExtractionRulesQuota
      responses:
        '200':
          description: Current state of Event Extraction Rules quota usage (limit and remaining).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventExtractionRulesQuotaUsage'
        default:
          description: Operation failed with an error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /v1/eventExtractionRules/{id}:
    get:
      tags:
      - event analytics
      summary: Get An Event Extraction Rule
      description: Get an event extraction rule.
      operationId: getEventExtractionRule
      parameters:
      - name: id
        in: path
        description: The identifier of the event extraction rule.
        required: true
        schema:
          type: string
        example: 000000000000000A
      responses:
        default:
          description: Operation failed with an error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '200':
          description: Requested event extraction rule.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventExtractionRuleWithDetails'
    put:
      tags:
      - event analytics
      summary: Update An Event Extraction Rule
      description: Update an event extraction rule.
      operationId: updateEventExtractionRule
      parameters:
      - name: id
        in: path
        description: The identifier of the event extraction rule.
        required: true
        schema:
          type: string
        example: 000000000000000A
      requestBody:
        description: Information to update event extraction rule.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EventExtractionRule'
        required: true
      responses:
        default:
          description: Operation failed with an error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '200':
          description: The event extraction rule was updated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventExtractionRuleWithDetails'
    delete:
      tags:
      - event analytics
      summary: Delete An Event Extraction Rule
      description: Delete an event extraction rule.
      operationId: deleteEventExtractionRule
      parameters:
      - name: id
        in: path
        description: The identifier of the event extraction rule.
        required: true
        schema:
          type: string
        example: 000000000000000A
      responses:
        default:
          description: Operation failed with an error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '204':
          description: The event extraction rule was successfully deleted.
components:
  schemas:
    FieldMapping:
      required:
      - valueSource
      type: object
      properties:
        valueSource:
          maxLength: 256
          type: string
          description: The actual value or field reference for the mapping.
          example: Knobs Changes
        mappingType:
          pattern: ^(HardCoded)$
          type: string
          description: Specifies valueSource is hardcoded.
          example: HardCoded
          x-pattern-message: Must be `HardCoded`
    ErrorResponse:
      required:
      - errors
      - id
      type: object
      properties:
        id:
          type: string
          description: An identifier for the error; this is unique to the specific API request.
          example: IUUQI-DGH5I-TJ045
        errors:
          type: array
          description: A list of one or more causes of the error.
          example:
          - code: auth:password_too_short
            message: Your password was too short.
          - code: auth:password_character_classes
            message: Your password did not contain any non-alphanumeric characters
          items:
            $ref: '#/components/schemas/ErrorDescription'
    EventExtractionRulesQuotaUsage:
      required:
      - quota
      - remaining
      type: object
      properties:
        quota:
          type: integer
          description: Maximum number of EventExtractionRules allowed.
          format: int32
          example: 200
        remaining:
          type: integer
          description: Remaining number of EventExtractionRules allowed.
          format: int32
          example: 121
    ErrorDescription:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
          description: An error code describing the type of error.
          example: auth:password_too_short
        message:
          type: string
          description: A short English-language description of the error.
          example: Your password was too short.
        detail:
          type: string
          description: An optional fuller English-language description of the error.
          example: Your password was 5 characters long, the minimum length is 12 characters. See http://example.com/password for more information.
        meta:
          type: object
          description: An optional list of metadata about the error.
          example:
            minLength: 12
            actualLength: 5
    ListEventExtractionRulesResponse:
      required:
      - data
      type: object
      properties:
        data:
          type: array
          description: List of event extraction rules.
          items:
            $ref: '#/components/schemas/EventExtractionRuleWithDetails'
    EventExtractionRule:
      required:
      - configuration
      - name
      - query
      type: object
      properties:
        name:
          maxLength: 256
          minLength: 1
          type: string
          description: Name of event extraction rule.
          example: foo
        description:
          maxLength: 1024
          type: string
          description: Description of event extraction rule.
          example: foo
        query:
          type: string
          description: "Query string for the Event Extraction Rule. Logs matching this query are periodically ingested into the `sumologic_userdata_events` index (**Events**).\n\nGuidelines for creating the query:\n  - Optimize the query to limit the number of returned log messages (intended for special logs only).\n  - The query runs in `Manual` mode, explicitly parse and extract only the necessary fields for event correlation and visualization.\n  - Use the `fields` operator to restrict the output to required fields.\n"
          example: _sourceCategory=eventSource
        correlationExpression:
          required:
          - eventFieldName
          - queryFieldName
          - stringMatchingAlgorithm
          type: object
          properties:
            queryFieldName:
              type: string
              description: Name of the query field returned by a log search query.
              example: _sourcecategory
            eventFieldName:
              type: string
              description: Name of the field from event query output.
              example: foo
            stringMatchingAlgorithm:
              pattern: ^(ExactMatch)$
              type: string
              description: Type of string matching algorithm which tells how to match eventFieldName and queryFieldName.
              example: ExactMatch
          description: "Correlation Expression specifies how to determine related events for a log search query. \nThe value of `eventFieldName` from Events is compared with the values of `queryFieldName` from the log search query output using the defined stringMatchingAlgorithm. Events that match according to this algorithm are considered correlated.\n"
        configuration:
          maxProperties: 1000
          required:
          - eventName
          - eventPriority
          - eventSource
          - eventType
          type: object
          additionalProperties:
            $ref: '#/components/schemas/FieldMapping'
          description: "Configuration for the Event Extraction Rule.\n\nThis object defines how event fields are mapped to their corresponding values.\nEach field specifies a `valueSource`, which provides the actual value, and an optional `mappingType`,\nindicating the value is hardcoded.\n\nThe following fields are **required**:\n  - `eventType`: Type of the event. Accepted values are `Deployment`, `Feature Flag Change`, `Configuration Change` or `Infrastructure Change`.\n  - `eventPriority`: Indicates the priority of the event. Accepted values are `High`, `Medium`, or `Low`.\n  - `eventSource`: Source system or component where the event originated (e.g., \"Jenkins\").\n  - `eventName`: Descriptive name of the event (e.g., \"monitor-manager deployed.\").\n\nThe following fields are **optional**:\n  - `eventDescription`: Additional context or details about the event.\n\nCustom fields can also be added as needed to capture domain-specific event data.\n"
          example:
            eventType:
              valueSource: Deploy
              mappingType: HardCoded
            eventPriority:
              valueSource: High
              mappingType: HardCoded
            eventSource:
              valueSource: Jenkins
              mappingType: HardCoded
            eventName:
              valueSource: monitor-manager deployed.
              mappingType: HardCoded
            eventDescription:
              valueSource: 2 containers in monitor-manager were upgraded.
              mappingType: HardCoded
    EventExtractionRuleWithDetails:
      type: object
      description: Event extraction rule object.
      allOf:
      - $ref: '#/components/schemas/EventExtractionRule'
      - required:
        - id
        type: object
        properties:
          id:
            type: string
            description: Id of the event extraction rule.
            example: '0000000001213227'
          createdAt:
            type: string
            description: Creation timestamp in UTC in [RFC3339](https://tools.ietf.org/html/rfc3339) format.
            format: date-time
          createdBy:
            type: string
            description: Identifier of the user who created the resource.
          modifiedAt:
            type: string
            description: Last modification timestamp in UTC.
            format: date-time
          modifiedBy:
            type: string
            description: Identifier of the user who last modified the resource.
          enabled:
            type: boolean
            description: Flag indicating whether the event extraction rule is enabled or disabled.
            example: true
          disableReason:
            type: string
            description: Reason for disabling the event extraction rule, if applicable.
            example: Event Extraction Rule output exceeded maximum allowed rate of 1000 events per hour in last 24 hours.
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
x-tagGroups:
- name: Archive Management
  tags:
  - archiveManagement
- name: Health Events
  tags:
  - healthEvents
- name: Infrequent Data Tier
  tags:
  - logSearchesEstimatedUsage
- name: Ingest Budgets Management V2
  tags:
  - ingestBudgetManagementV2
- name: Library Management
  tags:
  - appManagement
  - appManagementV2
  - contentManagement
  - dashboardManagement
  - folderManagement
  - lookupManagement
  - contentPermissions
  - logSearchesManagement
  - parsersLibraryManagement
- name: Metrics
  tags:
  - metricsSearchesManagement
  - transformationRuleManagement
  - metricsQuery
  - metricsSearchesManagementV2
- name: Security Management
  tags:
  - accessKeyManagement
  - oauthManagement
  - accountManagement
  - passwordPolicy
  - policiesManagement
  - samlConfigurationManagement
  - serviceAllowlistManagement
  - serviceAccountManagement
  - scimUserManagement
- name: Organizations Management
  tags:
  - orgsManagement
- name: Settings Management
  tags:
  - connectionManagement
  - dynamicParsingRuleManagement
  - extractionRuleManagement
  - fieldManagementV1
  - partitionManagement
  - scheduledViewManagement
  - logsDataForwardingManagement
  - dataDeletionRules
- name: Tokens Management
  tags:
  - tokensLibraryManagement
- name: Tracing
  tags:
  - traces
  - spanAnalytics
  - serviceMap
- name: Users and Roles Management
  tags:
  - roleManagement
  - roleManagementV2
  - userManagement
- name: Threat Intel Ingest Management
  tags:
  - threatIntelIngest
  - threatIntelIngestProducer
- name: OpenTelemetry Collector Management
  tags:
  - otCollectorManagementExternal
- name: Source Template Management
  tags:
  - sourceTemplateManagementExternal
- name: Schema Base Management
  tags:
  - schemaBaseManagement
- name: Event Analytics Management
  tags:
  - eventAnalytics
- name: Budget Management
  tags:
  - budgetManagement
- name: Macro Management
  tags:
  - macroManagement
- name: Muting Schedules Management
  tags:
  - mutingSchedulesLibraryManagement
- name: SLO Management
  tags:
  - slosLibraryManagement
- name: Monitor Management
  tags:
  - monitorsLibraryManagement